diff --git a/concourse/README-secrets.md b/concourse/README-secrets.md
index d11fd5a44..1e77a8529 100644
--- a/concourse/README-secrets.md
+++ b/concourse/README-secrets.md
@@ -6,4 +6,20 @@ https://vault.spring.vmware.com:8200/
 
 Requires VPN access. Login using VMWAre / LDAP creds.
 
+Note that if you put a secret in, you have to puts its
+value in the right box and put the word `value` in the
+left box.
+
+I.e. vault is forcing you to enter a secret as a json
+object. But since we typically just want it to be
+a single string, you have to enter it like so:
+
+```
+{
+    "value" : "the-real-value-you-want"
+}
+```
+
+See also the `put-secret-in-vaulr.sh` script for an
+example of how to use vault CLI instead.cat 
 
diff --git a/concourse/put-secret-in-vault.sh b/concourse/put-secret-in-vault.sh
old mode 100644
new mode 100755
index 9cf46cb7a..99ba04d3a
--- a/concourse/put-secret-in-vault.sh
+++ b/concourse/put-secret-in-vault.sh
@@ -1,2 +1,3 @@
 #!/bin/bash
-vault kv put concourse/tools/vsce_token value=something
\ No newline at end of file
+export VAULT_ADDR=https://vault.spring.vmware.com:8200
+vault kv put concourse/tools/vsce_token value=${vsce_token}